How to search for sources IPs with the highest number of distinct/unique HTTP methods?

[anton_chuvakin]

It seems simple but somehow the answer escapes me. I have Apache http access logs and I want to look for source IPs that produced the highest number of HTTP response codes, methods, etc.

E.g. 10.10.10.10 only used GET, while 11.11.11.11 used GET, POST, PUT, etc on my webserver. You can see where I am going with this.

So, what kinda query would do it?

[anton_chuvakin]

In the end, I ended us using these:

sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, method | stats count by clientip | sort -count

and this

sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, status | stats count by clientip | sort -count

with GREAT results that led me to some fun web mayhem that was happening.

Thanks a lot to all involved 🙂

[gkanapathy]

In addition to what lguinn posted, this

sourcetype="access_combined" | stats distinct_count(method) as dcm by clientip | sort -dcm

is fairly explicit.

[anton_chuvakin]

Thanks a lot for this!!

[gkanapathy]

Well, probably not more efficient, but more clearly corresponding to what you're asking for.

[lguinn2]

Ah, that's a more efficient solution.

[lguinn2]

Here are two examples of what you asked for --

Most number of methods used, not counting duplicates

sourcetype="access_combined" | dedup clientip, method  | top clientip

Most number of unique pages visited

sourcetype="access_combined" | dedup clientip, uri  | top clientip

But here are variations that might be more useful --

sourcetype="access_combined" | stats count by clientip, method | sort -count

sourcetype="access_combined" | stats count by clientip, uri | sort -count

Finally, take it to the next level by clicking the "Build Report" button and making a graph or chart of the results!

[anton_chuvakin]

Thanks a lot for this as well!!

[gkanapathy]

To really figure out what he asked, the last couple should actually look like: sourcetype="access_combined" | stats count by clientip, method | stats count by clientip | sort -count

[anton_chuvakin]

This (http://splunk-base.splunk.com/answers/6015/display-field-uniques-in-search) seems related but isn't quite the same since I need to rank by uniqueness...